{"id":"CVE-2026-107237","title":"Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live","summary":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account …","severity":"none","cwe":["CWE-862"],"product":"Backup and Staging by WP Time Capsule","affected":["backup_and_staging_by_wp_time_capsule < 1.22.28"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:19.869Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107237","references":[{"url":"https://wpscan.com/vulnerability/e9960aef-88c8-4a74-b479-55be75c25360/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.184Z","slug":"CVE-2026-107237","body":"## Overview\n\nThe Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.\n\n## Affected\n\n- `backup_and_staging_by_wp_time_capsule < 1.22.28`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}